A policy layer for GitHub pull requests.
Say yes to
contributions.
You decide who's trusted and which changes need a closer look. VOUCHA gives contributors a concrete way to confirm that a PR was intentional and that they stand behind it.
Open source and free.
Install in a click, or run your own.
The hosted app is free and works on public repos: install it on GitHub and configure the policy for your repo. Teams that want more control or private repos can self-host the same setup.
Questions maintainers ask.
How does it actually work?
A PR opens, the policy decides if a challenge is needed, and the author confirms that the PR is theirs and intentional before answering a short quiz built from the diff. Pass posts a check and attestation; fail offers a fresh retry, immediately by default. See the challenge lifecycle.
How does this fit with code review, CI, and branch protection?
Those check the code or route the PR; VOUCHA records intent and accountability for the PR. CI asks whether it works, review whether it's good, and VOUCHA whether the submission was intentional and the person submitting stands behind it. It runs before review, not instead of it.
Is this a quiz, or a governance layer?
A governance layer is one place to decide how much scrutiny a PR needs. Trust, exemptions, routing, and passive signals settle the coarse cases; the interactive challenge is the fine-grained last mile for the changes those can't.
Does it block merges?
Not by default. It posts a check and reports neutral on any failure, timeout, or outage, leaving enforcement to your branch-protection rules. Maintainers can optionally enable auto-close to close a PR that fails the challenge.
Isn't this gatekeeping contributors?
On the contrary. VOUCHA gives maintainers the confidence to say yes to contributions. AI-written code may be welcome, and VOUCHA lets maintainers ask that whoever submits it stands behind it.